DNS Firewall Features

Rate limit the number of queries per second that hit your DNS servers.

DDoS Mitigation for DNS

Advanced DDoS mitigation is baked right into the core of DNS Firewall.

Lightning-Fast DNS Lookups

By caching DNS responses on Cloudflare’s global network, responses are just milliseconds away from any visitor, anywhere.

Bandwidth Savings

Save bandwidth to origin nameservers by serving cached DNS responses.

Always Available DNS

By stale serving stored DNS responses when origin nameservers are down your DNS is always online.

Easy Setup

Just point your nameserver IP’s to Cloudflare.

"Cloudflare’s DNS Firewall is exactly what we needed to protect our DNS infrastructure. It is the leading company working in the DNS and web DDoS mitigation space."

-Sam Kottler Platform Engineer at DigitalOcean

How It Works

DNS Firewall makes running reliable DNS easy by protecting and accelerating any organization’s DNS infrastructure. With DNS Firewall enabled, DNS queries for your
nameservers get sent to the nearest Cloudflare data center where the legitimacy of the requests are checked and malicious traffic is blocked.
If the proper DNS response is available in Cloudflare's cache, Cloudflare will return the response to the visitor. If the DNS response is not
available in cache, Cloudflare will query the provider's nameservers in the background to fetch the DNS response and send it back to the visitor.

Onboarding DNS Firewall is easy, with a simple change of your nameservers’ IP addresses, your DNS infrastructure can be protected in as little as 5 minutes.

“Your protection has enabled us to keep growing without worrying about attacks to our DNS infrastructure. Your services have also given our clients a chance to reduce their bandwidth usage, and make their sites load faster.”

-Juan Zolezzi CEO of Duplika

Security: Cloudflare’s DNS Firewall Ensures 100% Clean Traffic

Control What Hits Your Network

Because DNS Firewall sits in front of your DNS nameservers, it shields your infrastructure, and only sends you
the traffic that you want to get. With the ability to rate limit traffic to your servers, you can specify
how much traffic Cloudflare should send to your nameservers. Rate limits are configurable over API, so you can
configure them dynamically based on your origin health.

Advanced DDoS Mitigation for DNS

DDoS attacks on DNS infrastructure are becoming increasingly more common. Cloudflare’s DNS Firewall has DDoS
mitigation at its core, leveraging the the same DDoS protection that has mitigated some of the largest DDoS
attacks to date. When malicious traffic is aimed at your origin nameservers, Cloudflare’s DDoS protection
reroutes that traffic and absorbs it across its global network.

Hide Your Origin IP Addresses From Attackers

Speed and Global Distribution

Respond Quickly From Anywhere

With DNS Firewall, Cloudflare caches DNS records at the edge of our globally distributed network, ensuring that queries are resolved
lightning-fast on every continent and in every major city regardless of origin server location.

Keep DNS Online When Your Nameservers Are Down

Even if your DNS servers are down, DNS Firewall can answer on your behalf by serving a stale answer from cache. That means your website
will be available and traffic continues to flow, even when your origin nameservers are compromised.

Caching and Bandwidth Savings

Cache DNS responses at the Edge

In addition to stopping attack traffic at the Cloudflare edge, DNS Firewall saves bandwidth to the origin nameservers.

DNS Firewall Vs. Authoritative DNS

Both services offer advanced security and performance improvements for DNS infrastructure. Cloudflare Authoritative DNS is a fully
managed and hosted DNS service. On the other hand, DNS Firewall allows you to continue to run your own infrastructure
and your DNS records stay on your own nameservers. DNS Firewall is great for hosting and cloud providers, DNS providers,
SaaS providers, registrars, registries, ISP’s and others running large authoritative DNS infrastructure.

Want DNS Firewall?

Cache DNS Responses at the Edge

DNS Firewall is sold as a separate product, regardless of plan type. For more information, contact our sales team.

To provide you with the best possible experience on our website, we may use cookies, as described here.By clicking accept, closing this banner, or continuing to browse our websites, you consent to the use of such cookies.